The password is optional, if you use, will be encrypted.
Am I correct in assuming that without the password, anyone that gets their hands on the metal card in question, can easily decrypt or rather access the information that's stored in it?
The question is also what is stored. Is it a plain text (words) or for example entropy (as seed words <-> entropy are exchangeable). But it would require an algorithm inside the application which would "understand" the seed words (verify checksum etc). And I suppose it would not support seeds other than BIP39, maybe would be even limited to English dictionary. Much simpler would be to store any text provided by user, without parsing it.